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THEMRURPOSES OF THESAGTS 


The purposes of the Freedom of Information and Protection of Privacy Act and the 
Municipal Freedom of Information and Protection of Privacy Act are: 


a) To provide a right of access to information under the control of government 
organizations in accordance with the following principles 
information should be available to the public; 
+ exemptions to the right of access should be limited and specific; and 


- decisions on the disclosure of government information may be reviewed by the 
Information and Privacy Commissioner. 


b) To protect personal information held by government organizations and to provide 
individuals with a right of access to their own personal information. 


The contents of this annual report are printed on recycled paper. 


The graphics and text pages were created and desktop published by staff 
at the Office of the Information and Privacy Commissioner/Ontario. 


Ce rapport annuel est également disponible en français. 
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COMMISSIONER'S MESSAGE 


In 1993 the Office of the Information and Privacy 
Commissioner (IPC) highlighted two fundamental 
challenges facing Ontario — the erosion of privacy 
by the pressures of technology, and the persistence 
of barriers against the wider sharing of government 
information with the public. Ontario’s success in 
meeting these challenges will have a profound 
influence on our lives, as individuals and as a 
community, in the next century. 


PRIVACY ON THE DEFENSIVE 


In the recent Supreme Court of Canada decision 
R. v. Dersch, [1993] 3 S.C.R. 768, Madam Justice 
L’Heureux-Dubé wrote, “...(I)n our modern 
informational society, where intimate details of 
one’s life may be available through computerized 
information accessible to many more persons than 
those initially entrusted with the knowledge, the 
security that information will be kept in privacy 
may be even more significant than one could have 
historically imagined”. 

Yet despite this sense of urgency, those who see 
privacy as a fundamental human value are con- 
stantly placed on the defensive, fighting a rear- 
guard action to recoup the privacy losses inflicted 
in the name of “progress”. 

We are witnessing the steady erosion of privacy 
through the creep of technology. Innovations such 
as photo radar and call management services are 
being adopted apparently for good reasons, such as 
traffic safety or consumer convenience, and govern- 
ment service cards are under development for the 
laudable aims of customer service and possible 
fraud reduction. But as surveillance increases on a 
piecemeal basis, privacy is also sacrificed bit by bit. 
One day soon we could wake up and find ourselves 
in 1984. 

To avoid this, we need a new privacy paradigm. 
Our society should insist that existing privacy 
rights be taken as inviolate. Those who propose to 
alter existing privacy levels should be required to 
demonstrate that the benefits to be gained out- 
weigh the privacy to be lost. 


In such a balancing process, we must ensure 
that the odds are not stacked against privacy by the 
tendency to overestimate the potential benefits of 
technology. Only if we take an objective view of 
what technology can actually deliver can we accu- 
rately determine if the privacy losses are acceptable. 

I am confident that technological progress will 
not decelerate if we impose tougher controls. 
Instead, the experts who develop new systems will 
find ways to make them compatible with privacy 
values. In this way, we can harness technology to 
protect privacy rather than undermine it. 

It is in the workplace that privacy issues are 
now reaching a flash point. In November 1993 the 
IPC completed a process of consultation and 
analysis on this subject with the release of the 
report, Workplace Privacy: The Need for a Safety- 
Net. 

In our report we call on the Ontario govern- 
ment to establish minimum workplace privacy 
standards through legislation in three areas: an 
outright ban on mandatory genetic, drug and HIV/ 
AIDS testing in the workplace; strict controls on 
video and other electronic surveillance of employ- 
ees; and extension to private sector workers of the 
employment record safeguards now available to 
government employees. 

Though new testing and monitoring technolo- 
gies are sometimes justified as a way of boosting 
productivity, the result is often the opposite. The 
reaction to the IPC’s report convinces me that the 
concerns are real, with potentially serious conse- 
quences for Ontario’s economic performance. A 
comprehensive safety-net is essential to impose 
some reasonable constraints before these damaging 
practices become entrenched in Ontario 
workplaces. 

This province must also confront a broader 
issue that is gaining momentum internationally — 
that of data protection in the private sector. The 
European Community has issued a draft directive 
on this theme. Closer to home, effective January 1, 
1994, Quebec has become the first jurisdiction in 
North America to regulate what business does with 
personal information. 


2 ANNUAL REPORT 1993 


The time has arrived for the Ontario govern- 
ment to respond to the public perception — well 
documented in opinion surveys — that personal 
privacy is under siege. Legislation is imperative to 
control when and how personal information can 
be collected, held, used or disclosed by the private 
sector in this province. 


ACCESS DEMANDS NEW APPROACHES 


On the freedom of information side of our man- 
date, the IPC is promoting expanded access to 
government records. We believe Ontario needs 
faster change in the organizational culture of the 
public sector, so that government sees itself as the 
custodian — not the owner — of the information 
under its control. This challenge demands strong 

leadership from the highest levels of both provin- 
cial and municipal governments. 

To reaffirm the commitment to openness, both 
provincial and municipal government organiza- 
tions should adopt a more flexible approach to the 
use of discretionary exemptions from disclosure 
requirements. Discretion should not mean a 
virtually automatic denial of access to information 
which may technically fall under an exemption. 

Instead, each request should be evaluated on its 
merits. If there is no harm to the interest protected 
by the exemption, then the request for information 
should be granted. Advice to government (from 
employees or consultants) and solicitor-client 
privilege are two exemptions that definitely could 
be applied more flexibly to improve access. 

More generally, government organizations 
should view freedom of information legislation as 
the minimum standard for openness, rather than 
as the ceiling of their access responsibilities. 

For some time, the IPC has been urging 
government organizations to identify in advance 
specific categories of records that could be released 
on demand, in response to either a formal or 
informal access request. More than this, we have 
called on government to anticipate customer needs 
by distributing useful information on its own 
initiative, without waiting to be asked. During 
1993 the IPC worked with Management Board 
Secretariat as well as provincial and municipal 
organizations to develop principles and practices 


for expanding the routine disclosure and active 
dissemination of information the public wants. 

In this context I would like to raise two points 
about the information superhighway, the focus of 
so much recent attention. First, the information 
superhighway is only a means of communication. 
What data actually travels along that road is 
another matter. From the point of view of govern- 
ment information, there will be little traffic mov- 
ing on the superhighway unless the traditional 
reflex towards secrecy is replaced by a vibrant 
commitment to openness. 

Second, the information superhighway must be 
accessible to all, without regard to geographical 
location or socioeconomic background. It is 
especially important to maintain equitable access 
to government information flowing on the high- 
way: there must be no financial toll booths. Other- 
wise we risk creating a new social division — 
between information “haves” and “have-nots”. 

Let me take this opportunity to salute a model 
use of the information highway — the Environmen- 
tal Bill of Rights enacted in December 1993. 
Among other aims, this legislation establishes an 
electronic registry of information on environmen- 
tal matters, including government decisions 
affecting the environment. Computer terminals to 
be located in public libraries will provide equitable 
and convenient access to this useful information 
on a critical public issue. 


THREE-YEAR REVIEW 


As 1993 drew to a close, the IPC was preparing for 
the three-year review of the Municipal Freedom of 
Information and Protection of Privacy Act. We 
developed a series of 53 recommendations for 
amendments to both the municipal and provincial 
Acts, for presentation to the legislature’s Standing 
Committee on the Legislative Assembly early in 
1994. 

Ontario’s current access and privacy laws apply 
only to provincial and municipal government 
organizations. Foremost among our recommenda- 
tions is a call to extend the legislation to hospitals, 
universities, social service agencies and professional 
governing bodies. 


These additional bodies perform significant 
public functions and many of them receive sub- 
stantial government funding. Providing access to 
their general records will make them more readily 
accountable. At the same time, these bodies often 
hold sensitive personal information, which requires 
legislated privacy safeguards. 

A second major amendment we suggest is to 
disclose the actual salaries of all provincial and 
municipal government employees. At present, 
legislation permits the release of salary ranges only, 
and no information can be divulged where no 
ranges exist. Again, broader access to information 
will increase accountability. 

Other IPC recommendations are intended to 
expand access to information, strengthen privacy 
protection and make the legislation more work- 
able. Among our proposed changes are: 


* a stronger “public interest override” clause 
authorizing the release of government records that 
are normally exempt from disclosure, where there 
is an overriding public interest; 


* special provisions dealing with electronic records, 
including mandatory consideration of access and 
privacy features in the design stage of government 
information systems; 


* safeguards to ensure continued public access 
when the private sector distributes basic infor- 
mation on government's behalf; and 


¢ limits on the introduction of new unique per- 
sonal identifying numbers by government 
organizations. 


We look forward to the release of the commit- 
tee’s report in 1994. A similar three-year review of 
the provincial Act was completed in 1991, but the 
government deferred action pending the municipal 
review. We trust the government will move ahead 
promptly with amendments to both Acts. 


COMMISSIONER'S MESSAGE 


PRODUCTIVITY UP 


1993 was year two in the IPC’s five-year plan to 
streamline operations and improve customer 
service. I am pleased to report that our productiv- 
ity has risen sharply under this plan. Our totals for 
both appeals closed and investigations completed 
in 1993 were more than double the levels recorded 
in 1991. 

This outstanding progress is a tribute to the 
dedicated efforts of our talented staff, as well as to 
excellent co-operation from government infor- 
mation and privacy co-ordinators across Ontario 
and from the Freedom of Information and Privacy 
Branch at Management Board Secretariat. 

I extend special thanks to the organizations 
that participated in two invaluable projects this 
year. The projects included the Appeals Pilot 
Project initiated by the Appeals Innovation Team, 
and the Forms Review conducted by the Compli- 
ance Department. The results of these initiatives 
have assisted all government organizations to 
deliver better access to information and stronger 
privacy protection. 

In the year ahead we in the IPC look forward 
to continued partnership with our colleagues in 
government and our customers, the people of 
Ontario, to sustain the values of access and privacy 
in the Information Age. 


Tom Wright 


Information and Privacy Commissioner 


THE IPC: OUR MISSION 


The Information and Privacy Commissioner (IPC) 
plays a crucial role under the Freedom of Infor- 
mation and Protection of Privacy Act and the 
Municipal Freedom of Information and Protection of 
Privacy Act (the Acts). Together, these two Acts 
establish a system for guaranteeing public access to 
government information, with limited exemptions, 
and for protecting personal information held by 
government organizations at both the provincial 
and municipal levels. 

The first Act applies to all provincial ministries 
and most provincial agencies, boards and commis- 
sions, as well as to colleges of applied arts and 
technology and district health councils. The second 
Act covers local government organizations, such as 
municipalities; public library, health and school 
boards; and public utilities, transit and police 
commissions. 

Ontario is in the forefront in combining the 
right to access with the right to privacy in the same 
legislation. 

Access refers mainly to information about what 
government organizations do, as reflected in 
administrative, operational and policy-related 
records. Access to such general records can be 
equated with open government. 

Privacy, on the other hand, concerns infor- 
mation about individuals. The Acts establish rules 
about how government organizations may collect 
and use personal data. In addition, individuals have 
the right to see their own personal information 
held by government organizations and are entitled 
to correct this information. 

The mandate of the IPC is to provide an 


independent review of government decisions and 


practices concerning access and privacy. To safe- 
guard the rights established under the Acts, the IPC 


plays five roles: 


° resolving appeals when government organizations 
refuse to provide requested information; 


* investigating privacy complaints about govern- 
ment-held information; 


* ensuring that government organizations comply 
with the Acts; 


* conducting research on access and privacy issues 
and providing advice on proposed government 
legislation and programs; and 


* educating the public about Ontario’s access and 
privacy laws. 


The Information and Privacy Commissioner 
reports to the Legislative Assembly of Ontario. The 
Commissioner is therefore independent of the 
government of the day and in a position to carry 
out duties even-handedly. The present Commis- 
sioner was appointed in 1991 for a five-year term 
on the recommendation of an all-party committee 
of the legislature following an open, competitive 
selection process. 

In line with the legislation, the Commissioner 
has delegated some of his decision-making powers 
to his staff. The Assistant Commissioner (Access) 
and four Inquiry Officers have authority to issue 
orders resolving appeals. And the Assistant 
Commissioner (Privacy) investigates privacy 
complaints, reviews government practices and 
approves applications for indirect collection of 
personal information. 
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Provincial and municipal government organiza- 
tions file a yearly report with the IPC on their 
activities under the Acts. These reports include data 
on the requests received for general records, per- 
sonal information and correction of information, 
as well as on the organization’s response to these 
requests. Compiling these reports gives us a useful 
picture of compliance with the Aczs. 

In all, provincial government organizations 
received 11 268 requests for access to information 
in 1993 — the highest annual total since the provin- 
cial Act took effect. The 1993 figure was more than 
50 per cent above the average number of requests 
over the previous five years. Municipal government 
organizations reporting for 1993 received a total of 
8475 requests, up 19 per cent from 1992. 

Requests for general records outnumbered 
those for personal information by about three and 
a half to one in provincial organizations, and two 
to one in municipal organizations. This was con- 
sistent with previous trends: in every year under 
either Act, requests for general records have ex- 
ceeded those for personal information. 

Also in line with previous trends, both provin- 
cial and municipal organizations had answered the 
vast majority of requests received in 1993 by the 
end of the year. Very few requests were carried over 
to 1994. 

The Ministry of Finance reported the highest 
number of requests under the provincial Act, 
followed by the Ministry of the Solicitor General 
and Correctional Services, the Ministry of Labour 
and the Ministry of Community and Social Serv- 
ices. Together, these four Ministries accounted for 
67 per cent of all requests received by ministries 
and 60 per cent of all provincial requests (to 
ministries or agencies). 

Under the municipal Act, municipal corpora- 
tions (including all municipal governments) 
received 58 per cent of total requests. Police 


INFORMATION REQUESTS TABULATED ACROSS GOVERNMENT 


services boards were next with 29 per cent, fol- 
lowed by public utilities and school boards, each 
with about five per cent. 


Requests Received and Completed — 1993 


15000 


Correction 
Requests 


4 Municipal 


Personal Record 
Requests 


General Record 
Requests 


Provincial 


In all six years of operation of the Act, provin- 
cial government organizations have replied to the 
majority of requests within 30 days. In 1993, 

51 per cent of provincial requests were answered 
within 30 days; 88 per cent within 60 days; while 
only three per cent took more than 120 days. 

Municipal government organizations responded 
to a sizable majority of requests — 91 per cent — 
within 30 days in 1993, virtually the same level as 
in the two previous years. Ninety-seven per cent of 
municipal requests this year were answered within 
60 days and only one per cent took more than 120 
days to complete. 

The overall outcome of requests this year was 
similar to the 1992 result. Just over half of both 
provincial and municipal requests led to the release 
of all information sought. In only about one in 10 
cases was no information disclosed. 


Outcome of Provincial Requests — 1988-93 


All Disclosed Nothing 
Disclosed in Part Disclosed 


1988 a 1989 
1992 


Withdrawn/ 
Abandoned 


1991 


All Disclosed Nothing 
Disclosed in Part Disclosed 


= 1991 1992 ol 1993 


Withdrawn/ 
Abandoned 


Under the exemption provisions of the Acts, 
government organizations can and in some cases 
must refuse to disclose requested information. 
Following the pattern of the past few years, both 
provincial and municipal organizations in 1993 
cited two exemptions most frequently — personal 
privacy and law enforcement. 
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Provincial Exemptions Used 
General Records — 1993 


Section 17 — Third Party 
Information 207 (10.1%) 


-———_— Section 14 - Law 
| Enforcement 276 (13.4%) 


Other — 700 (34.0%) 


Section 21 — Personal 
Privacy 875 (42.5%) 


Municipal Exemptions Used 
General Records — 1993 


Section 10 — Third Party 
Information 154 (8.0%) 


Section 14 — Personal Other — 355 (18.5%) 


Privacy 969 (50.6%) 
Section 8 — Law 
Enforcement 438 (22.9%) 


Provincial Exemptions Used 
Personal Information — 1993 


Section 14 — Law 
Enforcement 58 (6.0%) 


à — Section 17 — Third Party 
À Information 76 (7.9%) 


— Other — 200 (20.7%) 


Section 49 — Personal 
Information 631 (65.4%) 


Municipal Exemptions Used 
Personal Information — 1993 


______ Section 12 — Solicitor-Client 
Privilege 63 (6.0%) 


Section 38 — Personal — Other — 179 (16.9%) 
Information 522 (49.3%) 
__ Section 8 — Law 

Enforcement 294 (27.8%) 
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Under the legislation individuals have the right 
to correct their personal information held by 
government. This year provincial organizations 
received 33 correction requests and refused 17 of 
them, continuing a trend toward refusal rather 
than correction. On the other hand, municipal 
organizations fully granted 64 of the 91 correction 
requests they received. 

When correction is refused, the requester may 
attach a statement of disagreement to the record, 
outlining why the information is felt to be incor- 
rect. This year five provincial and 15 municipal 
statements of disagreement were filed. 

The legislation permits government organiza- 
tions to charge fees for providing access to infor- 
mation under certain conditions. À fee estimate 
must be provided before filling the request where 


the expected charge is over $25. Organizations 
have discretion to waive payment where it seems 
fair and equitable to do so after considering several 
specific factors. In addition, institutions cannot 
require people to pay fees for access to their own 
personal information. 

As in previous years, provincial organizations 
most often cited reproduction of material as the 
reason for collecting fees in 1993. Reproduction 
costs were mentioned in 40 per cent of cases where 
fees were collected, followed by preparation costs 
in 37 per cent and shipping costs in 20 per cent. 
Municipal organizations reported a similar pattern 
for 1993 — with reproduction costs cited in 37 per 
cent of cases where fees were collected, preparation 
in 27 per cent and shipping in 17 per cent. 


Cases in Which Fees were Estimated 
General Records — 1993 


Provincial Municipal 
Collected in Whole 85.2% 3070 54.4% 1506 
Waived in Part 0.1% 2 1.2% 33 
Waived in Full 14.7% 531 44.4% 1227 
Total Fees Collected (dollars) $105,092.15 $47,489.59 
Total Fees Waived (dollars) $7,218.99 $10,504.61 


RESOLVING APPEALS : | 


If a government organization declines to release 
information, the requester can appeal to the IPC. 
Appeals can also be lodged concerning a refusal to 
correct personal information, the imposition of fees 
or other aspects of the handling of a request. 

When an appeal is filed, the IPC attempts to 
mediate the case. If the disagreement is not settled 
within a reasonable time, we issue a binding order 
to resolve the appeal. 


Efficiency Rises 


The efficient processing of appeals ranks as a major 
priority at the IPC. This year the number of 
appeals resolved increased 26 per cent from the 
previous year, and 69 per cent of all appeals were 
completed within six months. 

During the year four staff members served as 
Inquiry Officers with authority to decide appeals. 
This raised the number of decision-makers to six, 
increasing our capacity to produce orders. Due in 
part to this change, the number of orders issued in 
1993 rose 90 per cent over the previous year’s 
total. 


INNOVATION PAYS OFF 


A major contributor to our higher productivity was 
the Innovation Pilot Project launched on January 
1, 1993 to simplify appeal procedures and improve 


customer service. Fourteen municipal and provin- 


cial government organizations are participating in 
this initiative. A special Appeals Innovation Team 
of IPC staff handles all appeals from the participat- 
ing institutions. 

The objective is to implement a time-driven 
rather than paper-driven process. At the outset of 
each appeal, a four month deadline is set for 
completion. Within this time frame it may not be 
possible for mediation to resolve all issues. Instead, 
the focus of mediation is to narrow the dispute. 
Orders are seen not as a last resort but as the most 
efficient solution in many cases. The project is also 
experimenting with alternatives to written repre- 
sentations, such as over the phone and in person to 
the decision-maker. 

To fine-tune the process, the Innovation Team 
obtained feedback from both appellants and 
government organizations through client surveys. 
The results were generally positive. Even appellants 
whose appeals were unsuccessful were satisfied with 
the service they received. In addition, an advisory 
group representing the 14 institutions has been 
established to provide input to the IPC on how the 
project is working. 

Using the new procedures, the Innovation 
Team completed approximately 85 per cent of its 
appeals within the four-month target. The project 
will continue in 1994, and the features that prove 
valuable will eventually be extended to the process- 
ing of all appeals. Also in 1994, the IPC plans to 
introduce more reforms to further reduce the time 
needed to resolve an appeal. 
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Statistical Overview 


In all, 1190 appeals* were made to the IPC in 
1993 — up nine per cent from the previous year. 
The provincial Act accounted for slightly more 
than half of all appeals lodged. 

The volume of municipal appeals increased 24 
per cent over 1992, while the number of provincial 
appeals remained virtually unchanged. The largest 
share of municipal appeals — 45 per cent — con- 
cerned municipal corporations, followed by police 
services boards and school boards. Eighty-four per 
cent of provincial appeals involved ministries rather 
than agencies. 


Appeals Received — 1988-93 


1988 1989 1990 (CE ET HEC 


EE Provincial 


* An additional 741 inactive appeals were received during 1991 
** An additional 129 inactive appeals were received during 1992 
*** An additional 28 inactive appeals were received during 1993 


Municipal 


Although the Acts do not require appellants to 
provide information about themselves, the IPC 
tries to identify various categories of appellants. 
Since this exercise is rather subjective, the resulting 
information should be treated with caution. As in 
previous years, the figures indicate that the prime 
user of the appeals system is the general public, 
rather than businesses or other kinds of 
organizations. 


Types of Requesters Involved in Appeals — 1993 


400 
300 5 
200 
100 
0 
Provincial Municipal 
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Types of Appeals Provincial 
Request for general records 191 30.3% 
Request for personal information 94 14.9% 
Request for general records/ 

personal information 249 39.5% 
Request for correction of 

personal information 4 0.6% 
Time extension 14 2.2% 
Fees 48 7.6% 
Third Party si 4.9% 
Total 631 100.0% 


Appeals Received by Issue — 1993 


Municipal Total 
221 39.5% 412 34.6% 
108 19.3% 202 17.0% 
123 22.0% 372 31.3% 
7 1.3% 11 0.9% 
6 1.1% 20 1.7% 
70 «125% 118 9.9% 
24 4.3% — 55 4.6% 
559 100.0% = 1190 100.0% 


* The statistics cited in this annual report refer to active appeals only, unless otherwise indicated. In 1991 the IPC established a policy of limiting the number of 
appeals from any one source that we will work on at one time. This policy was necessary to deal with bulk use of the appeal process. Active appeals are those that 
were actively worked on by the IPC during the year. All other appeals are classified as inactive. 


The IPC closed a total of 1408 appeals during 
1993 — up about one-quarter from 1122 in 1992. 
Fifty-five per cent of appeals resolved this year 
concerned provincial government organizations. 
Provincial appeals closed were up nine per cent 
while municipal appeals closed increased 55 per 
cent. 

Of the cases closed this year, we resolved 30 per 
cent by issuing an order, compared with 22 per 
cent closed by order in 1992. Provincial appeals 
were somewhat more likely to result in an order: 
32 per cent of provincial and 28 per cent of 
municipal appeals were closed by order this year. 

In all, the IPC issued 378 orders during 1993 — 
nearly double the total of 199 issued the previous 
year. (The number of orders is less than the 
number of appeals closed by order, since an order 
may deal with more than one appeal.) Orders were 
more evenly divided between provincial and 
municipal organizations this year. Fifty-six per cent 
of orders concerned provincial organizations, 
compared with 65 per cent in 1992. 


Orders Issued — 1988-93 


1988 1989 1990 1991 1992 1993 


a Provincial 


| Municipal 


In appeals resolved by order, the decision of the 
head of the government organization involved was 
either not upheld or partly upheld in half of all 
cases. Where appeals were closed by means other 
than an order, the most frequent outcome by far 
was settlement by mediation. In fact, a mediated 
settlement occurred in a majority (54 per cent) of 


RESOLVING APPEALS 


all appeals resolved by any means this year. These 
trends are similar to those observed in the previous 
year. 


Outcome of Appeals Closed by Order 
Provincial — 1993 


Other 12 (4.8%) 


Head's Decision 
Upheld 109 (43.8%) 


Head's Decision Not 
Upheld 47 (18.9%) 


Head's Decision Partly 
Upheld 81 (32.5%) 


Outcome of Appeals Closed by Order 
Municipal — 1993 


Other 5 (2.8%) 


Head's Decision Not 
Upheld 35 (19.8%) 


Head's Decision 
Upheld 86 (48.6%) 


Head's Decision Partly 
Upheld 51 (28.8%) 


Outcome of Appeals Closed Other Than by Order 
Provincial — 1993 


Non-jurisdictional 5 (1.0%) 
Abandoned 9 (1.7%) 


Settled 415 (79.2%) Withdrawn 95 (18.1%) 


Outcome of Appeals Closed Other Than by Order 
Municipal — 1993 

Non-jurisdictional 9 (2.0%) 

Abandoned 24 (5.2%) 


Settled 338 (73.8%) Withdrawn 87 (19.0%) 
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Highlights of Orders 


The following sections describe major issues 
decided by the IPC in orders issued this year. 


RELEASE OF SEVERANCE AGREEMENTS 


Severance agreements between government organi- 
zations and departing employees were the focus of 
several appeals. The central issue was whether the 
contents of such agreements are exempt from 
disclosure because their release would result in an 
unjustified invasion of the personal privacy of the 
employees involved. 

The IPC has held that clauses in a severance 
agreement conferring monetary entitlements do 
not define employment history. Nor do they 
describe an individual’s finances, income, assets, 
net worth or financial activities. Hence, under the 
Act the disclosure of information found in such 
clauses is not automatically presumed to be an 
unjustified invasion of personal privacy. 

Disclosure of the personal information con- 
tained in severance agreements therefore depends 
on consideration of the criteria for invasion of 
personal privacy as enumerated in the Acts, as well 
as on the circumstances of the case. Among the key 
criteria is whether the disclosure is desirable for the 
purpose of subjecting the activities of the govern- 
ment organization to public scrutiny. (Order 


M-173) 


HARASSMENT INVESTIGATIONS 


During the year the IPC dealt with a number of 
appeals concerning records of harassment investiga- 
tions. We have stressed that it is neither practical 
nor possible to guarantee complete confidentiality 
to all parties during an internal investigation of this 
nature. It is the IPC’s position that those who are 
accused of misconduct must be apprised of the 
substance of the allegation and who made it, in 


order to respond. (Order M-82) 


l = ARTE : 5 Saget 
; This order was under judicial review at the time of writing. 
~ This order was under judicial review at the time of writing. 


In one case an individual who had been accused 
of harassment requested records of interviews 
conducted by the investigator. Five of the seven 
people interviewed consented to release of their 
records. 

The Ministry withheld some of the requested 
information, arguing that it was highly sensitive 
and implicitly given in confidence. On appeal, the 
IPC held that these two criteria were relevant only 
to the personal information of the individuals who 
had not consented to disclosure, and then only to 
information that did not directly address the 
substance of the complaint. (Order P-447') 


ACCESS TO DATA THROUGH 
COMMERCIAL VENDORS 


Provincial and local government organizations are 
examining their vast information holdings as a 
potential source of non-tax revenue. This new 
approach raises the critical question of how the 
public’s right of access to information will be 
balanced with the need for new revenues. 

This issue arose in an appeal involving the 
Ontario Securities Commission (OSC). When a 
requester sought a current list of limited market 
and securities dealers, the OSC refused the request 
on the grounds that the records were currently 
available to the public by subscription through a 
private company, Micromedia Limited. 

The IPC had previously ruled that for records 
to qualify as “currently available to the public”, 
they must be available to members of the public 
generally through a regularized system of access 
(Order P-327). In this case we held that while a 
private entity like Micromedia might provide a 
system of access, it did not provide a regularized 
system of access available to the public generally. 

Micromedia is not the equivalent of a govern- 
ment publications centre or a government-run 
public registry. Hence the records were not cur- 
rently available to the public and the IPC ordered 
their disclosure to the appellant. (Order P-496°) 


FEE WAIVERS AND PUBLIC SAFETY 


Under the Acta government organization may 
charge a fee for providing access to a record, but 
has discretion to waive the fee. In a case this year 
the requester sought records from Ontario Hydro 
concerning 23 projects originally included in 
Hydro’s rehabilitation plans for the Bruce A 
Nuclear Generating Station, but later excluded 
from that project. Hydro granted partial access to 
the records but provided a substantial fee estimate. 

The requester asked Hydro to waive the fee on 
the grounds that disclosure would benefit public 
health and safety, one of the factors listed in the 
Act for consideration in deciding on a fee waiver. 
Hydro refused and the requester appealed both the 
amount of the fee and the decision not to waive it. 

The IPC stated that the standard which applies 
to review of a decision to charge a fee or the 
amount of a fee is simply one of correctness. We 
then considered whether the dissemination of the 
records would benefit public health or safety, 
applying several criteria we believed relevant. 

We found that dissemination of the records 
would contribute to public understanding of a 
major public health and safety issue, the mainte- 
nance of aging nuclear reactors. We also noted the 
requester’s pledge to release the records to the 
public. We therefore ordered Hydro to waive the 
fee. (Order P-474) 


ACCOMMODATING VISUALLY 
IMPAIRED REQUESTERS 


What are the responsibilities of government or- 
ganizations to visually impaired requesters? This 
question arose when a visually impaired individual 
asked a Ministry for access to his personal infor- 
mation in an enlarged-print format. 

A Ministry staff member spent several hours 
reading parts of the file to the requester, and 
during mediation the Ministry transcribed a 
portion of the record into large type. The Ministry 
contended, however, that providing the full record 
in the preferred format would entail prohibitive 
costs. 


RESOLVING APPEALS 


On appeal by the requester, the IPC found that 
the requirement under the Act to supply records in 
a comprehensible format meant in a format com- 
prehensible to an average person. Accordingly, a 
government organization has no obligation under 
the Act to provide information to a visually im- 
paired person in an alternative format. 

However, the IPC also ruled that the Ministry 
was bound to respect the requester’s rights as a 
handicapped person under Ontario Human Rights 
Code. We concluded that the Ministry’s efforts to 
accommodate the requester’s needs effectively 
allowed him to access his personal information. At 
the same time, we called on the Ontario govern- 
ment to establish clearly the obligations of govern- 
ment organizations when responding to access 


requests of this type. (Order P-540) 


PETITION NOT CONFIDENTIAL 


The status of petitions has been debated before the 
IPC, and we have stated firmly that petitions by 
their very nature are not documents that have an 
aura of confidentiality. Those who sign a petition 
do so voluntarily and by their signature take a 
public stand regarding the matter at issue. Petition- 
ers are therefore aware that they are revealing 
personal information when they add their names to 
the petition. 

A case this year involved a petition signed by 54 
individuals, who were exercising their right under 
the Municipal Act to request the appointment of a 
commission of inquiry into the administration of a 
township. The solicitor of the township asked the 
Ministry of Municipal Affairs for access to the 
petition. The Ministry released the introductory 
text but refused to supply the names and addresses 
of the signers, claiming that to do otherwise would 
be an unjustified invasion of their personal privacy. 

The IPC held that in the circumstances, it was 
not reasonable to expect the petitioners’ identities 
to be kept confidential. The Ministry was ordered 
to disclose the record to the appellant. (Order 
P-516) 
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Settlement by Mediation 


The majority of appeals are resolved through 
mediation. Here are a few examples of successful 
mediation efforts this year. 


BOARD MEMBERS’ ADDRESSES 
WITHHELD | 


An individual involved in a longstanding dispute 
with a college of applied arts and technology 
requested access to the names and home addresses 
of the board of governors. He wanted to write to 
the board members directly, fearing the college 
might be intercepting his correspondence. When 
the college refused the request, he appealed to the 
IPC 

During mediation both parties agreed that the 
college would give the individual a written guaran- 
tee that his letters to board members would not be 
opened and would be forwarded to them directly. 
On this basis the appeal was withdrawn. 


NEUTRAL THIRD PARTY 


A teacher requested a separate school board to 
provide a copy of a letter written about her by 
another teacher. When the board indicated its 
intention to grant access, the author of the letter 
appealed. The requester was concerned that the 
letter might be an “adverse report” as defined 
under the Ontario Teachers’ Federation regula- 
tions, which set out procedures for dealing with an 
adverse report by one teacher against another. 

During mediation both parties agreed to have 
the local teachers’ union president examine the 
letter to determine whether or not it was an adverse 
report. If an adverse report was found, the union 
would deal with it appropriately; otherwise the 
matter would be dropped. On this basis the appeal 
to the IPC was withdrawn. 


ACCES S2TOAUD MMREROIRI 


The Ministry of Health conducted an operational 
audit of a business. À requester sought a copy of 
the audit, and the operator of the business ap- 
pealed the Ministry’s decision to release the infor- 
mation. Following initial discussions, the IPC 
Appeals Officer suggested that the requester and 
the appellant talk to each other about the infor- 
mation and why it was being sought. They agreed 
to do so and reached a mutually satisfactory 
solution. 


Judicial Review 


Like decisions of other administrative tribunals, 
orders issued by the Information and Privacy 
Commissioner may be reviewed by the courts on 
jurisdictional grounds. 

At the end of 1992 there were 14 applications 
for judicial review pending. Five of these cases were 
resolved during 1993, and 24 new applications 
were filed. As a result, there were 33 judicial review 
applications outstanding at the end of 1993. 


Outstanding Judicial Reviews — 1993 


Launched by 
IPC 

Requesters 
Affected Parties 
Institutions 
Total 


@ ND 
© ND © D — 


PERSONAL INFORMATION 
OF WITNESSES 


One case decided this year dealt with the personal 
information of witnesses to an alleged offence. On 
behalf of the accused, the appellant sought access 
to the names and addresses of the witnesses. The 
institution having custody of the information, the 
Metropolitan Toronto Police, refused to disclose 
the information on the basis of several exemptions 
under the municipal Act. 


On appeal, the IPC upheld the decision of the 
police, citing in particular section 14(3)(b). This 
section provides that a disclosure of personal 
information is presumed to constitute an unjusti- 
fied invasion of personal privacy if the personal 
information was compiled and is identifiable as 
part of an investigation into a possible violation of 
law, except where necessary to prosecute the 
violation or continue the investigation. (Order 
M-28) 

The appellant applied for judicial review, 
arguing among other points, that the IPC had 
erred in law in concluding that the disclosure 
would constitute an unjustified invasion of per- 
sonal privacy. The Divisional Court dismissed the 
application’, stating in part: 


We are satisfied that the presumption con- 
tained in section 14(3)(b) applies. The excep- 
tion therein, in our view, does not relate to 
possible proceedings against the interested 
parties... The Commissioner made no legal 
error and it is not our role to substitute our 
judgment on the merits for the decision made 
by him. 


POLICE INVESTIGATION REPORT 


Another case this year concerned an investigation 
by the Ontario Provincial Police into allegations of 
perjury and fabrication of evidence against four 


RESOLVING APPEALS 


police officers. A requester sought access to the 
investigation report. On appeal the IPC decided 
that a copy of the report with some information 
withheld should be disclosed. (Order P-237) 

We held that the presumption against disclo- 
sure of police investigation information under 
section 21(3)(b) of the Act had been rebutted by a 
combination of factors under section 21(2). The 
latter subsection lists criteria for determining 
whether or not a disclosure constitutes an invasion 
of personal privacy. The relevant factors in this case 
included the desirability of subjecting the institu- 
tion to public scrutiny. 

The four police officers applied to the Divi- 
sional Court for judicial review. The Court found’ 
that in the clear words of the statute, once the 
presumption under section 21(3) has been estab- 
lished, it may be rebutted only by the criteria set 
out in section 21(4) or by the public’interest 
override in section 23. There was nothing in the 
statute to confuse the presumption in section 21(3) 
with the balancing process in section 21(2). 

Accordingly, the Court overturned the IPC’s 
order and found that the report should not be 
released. The Court also commented on the 
standard of review that should be applied to the 
IPC’s decisions. The Court stated that the Com- 
missioner’s decisions “ought to be accorded a 
strong measure of curial deference.” The implica- 
tion is that, in most cases, the IPC’s decisions will 
be upheld unless they are found to be patently 


unreasonable. 


"Garrett Lewis v. Information and Privacy Commissioner et al. (4 June 1993), Toronto 500/92 (Ont. Div. Cr.) 
“John Doe v. Ontario (Information and Privacy Commissioner) (1993), 13 O.R. (3d) 767 (Div. Ct.) 


PRIVACY COMPLAINTS INVESTIGATED AND PRACTICES REVIEWED 


The provincial and municipal Acts create rules for 
the collection, retention, use, disclosure, security 
and disposal of personal information in the custody 
and control of government organizations. Indivi- 
duals who believe that their privacy has been 
compromised by a government organization can 
complain to the IPC. We investigate the com- 
plaint, try to mediate a solution and, depending on 
the findings, may make recommendations to the 
organization to revise its practices. 

A few IPC investigations are appeals-driven. 
That is, we may decide to study an organization’s 
procedures if problems come to light during an 
appeal. 

_In addition to responding to specific com- 
plaints and issues, the IPC on its own initiative 
selects certain government organizations and 
examines their practices for handling personal 
information. These broader compliance reviews 
give us a further tool for ensuring that organiza- 
tions adhere to the legislation. 

Occasionally a privacy investigation leads to 
questions that are broader than the subject matter 
of the complaint. In such cases, we may offer 
further comments to the government organization 
involved. In addition, we sometimes comment on 
specific problems or circumstances affecting pri- 
vacy, outside the context of an investigation. 


Through our investigation reports, compliance 
reviews and comments we are often able to provide 
insights and suggestions that are useful, not only to 
the parties concerned, but to government organiza- 
tions more generally. 


Better Customer Service 


We completed 215 investigations this year, up six 
per cent from last year’s completion total. In nearly 
three out of 10 complaints investigated, we found a 
breach of the legislation. 


Number of Privacy Investigations Completed 
1988-93 


100 


50 


1988 1989 1990 1991 1992 1993* 


h | Provincial fe Municipal 


* does not include nine non-jurisdictional investigations 


_ 1992 Privacy 


In Process 20 34 


Municipal numbers appear in bold 


Summary of Privacy Investigations — 1993 


Complaints 
Carried Forward 51 38 
Initiated 78> 94: 
Completed 104 98 


1992 1993 Privacy 1993 | 
Total Complaints Total 
89 20 34 54 
167 118 St 208 
202 106 100 215 


54 de 15 47 


* includes nine investigations that were discovered to be non-jurisdictional during the course of the investigation 


Privacy Investigations Completed 
by Outcome — 1993 


Provincial Municipal 
Breached _ | Complied Non- 
the Act with the Act jurisdictional 
Issue 
Not Unable 
Personal to Conclude 
Information 


In 1992 the IPC began trying to resolve com- 
plaints without a formal report by encouraging 
mediation and voluntary settlement. This approach 
was refined in 1993, leading to significant resource 
savings and better customer service. A formal 
report was issued in less than one-third of cases. 
The average time to complete an investigation 
dropped by two-thirds — to 1.9 months in 1993 
from 5.8 months in 1992. 


Privacy Investigations Completed 
by Type of Resolution — 1993 


Provincial Municipal 
Mediated/ Abandoned/ 
Ex Report Settled Withdrawn 


PRIVACY COMPLAINTS INVESTIGATED AND PRACTICES REVIEWED 


Three-quarters of provincial investigations and 
one-half of municipal investigations this year 
concerned the disclosure of personal information. 
The next most frequent issue was collection of 
personal information, which accounted for 16.1 
per cent of provincial investigations and 39 per 
cent of municipal investigations. 


Privacy Investigations Completed by Issue 
Provincial — 1993 


Disclosure 80 (75.5%) —— Collection 17 (16.1%) 
Security 1 (0.9%) 

— Notice 3 (2.8%) 
Correction 2 (1.9%) 
Access 2 (1.9%) 

Use 1 (0.9%) 


Privacy Investigations Completed by Issue 
Municipal — 1993 


Access 2 (2.0%) - Retention 2 (2.0%) 
Security 1 (1.0%) 

— Use 3 (3.0%) 

— Personal Information 
Bank 2 (2.0%) 


Disclosure 51 (51.0%) Collection 39 (39.0%) 


One-quarter of all complaints were filed by an 
employee of the government organization that was 
the subject of the complaint. It appears likely that 
government employees may be more aware of the 
existence of the Acts and their privacy rights under 
them. 
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Types of Complainants Involved in 
Privacy Investigations — 1993 


Provincial Municipal 


Third Party 
Complaint 


Employee of 
Institution 


Group 
Complaint A Other 


Member of 
the Public 


ORAL COMPLAINTS 


Written complaints are not the only way of seeking 
IPC assistance in privacy matters: we also respond 
to privacy concerns or complaints expressed over 
the telephone. 

This year we resolved 163 oral privacy concerns 
or complaints. Most calls pertained to the disclo- 
sure of information. In a number of cases we 
contacted the government organization involved 
and brought the matter to their attention. 


Investigation Highlights 


The following are brief descriptions of key com- 
plaint investigations in 1993. 


COVERT SURVEILLANCE JUSTIFIED 


An employee complained that a school board had 
engaged a private investigator to videotape his 
activities outside the employer’s premises during 
working hours. This information was used to 
terminate the individual’s employment and subse- 
quently was disclosed at a grievance hearing into 
the dismissal. 


The IPC ruled that a videotaped recording of 
an individual was recorded personal information as 
defined under the Act. We concluded that the 
school board had reasonable grounds for believing 
that the employee was engaging in some other 
form of employment during his working hours; 
under the circumstances we considered the video 
surveillance to be justified, in order to prove these 
allegations. 

We held that this collection of personal infor- 
mation was necessary for the employer to discharge 
the lawfully authorized management function of 
terminating an employee for cause. We also found 
that the disclosure of the information at the griev- 
ance hearing was consistent with the purpose for 
which it had been collected. (Investigation 


192-55M) 


CLOSED CIRCUIT TELEVISION 


For security reasons, the Liquor Control Board of 
Ontario had installed a closed circuit television 
system in the general office areas of its premises. 
The IPC investigated following an employee 
complaint. 

We found that the board’s activity of protecting 
its personnel and assets was a lawfully authorized 
one. We agreed that the collection of personal 
information through video cameras at the entrance 
and exit points of the building, as well as at the 
access doors to related facilities, was necessary for 
this security-related activity. 

However, it was our view that during office 
hours, video cameras in the corridors of the general 
office areas were being used for employee monitor- 
ing purposes. We did not believe this collection of 
personal information to be in compliance with the 
Act. Accordingly, we recommended that these 
cameras be deactivated during regular office hours. 

When we later followed up on our recommen- 
dation, the board informed us that the video 
cameras in question were in fact being used during 
office hours for safety and security purposes, and 
that staff welcomed the presence of these cameras. 
Further investigation by the IPC and interviews 
with staff confirmed this. 


However, we found that employees had not 
been made fully aware of the safety reasons for the 
presence of the video cameras. We therefore 
recommended that the board inform all employees 
in writing of the safety and security reasons for the 
installation of cameras on the board’s premises. 


(Investigation 193-026P) 


REFERENCE CHECKING 


A teacher had completed various short-term, 
occasional teaching assignments for a school board 
over a period of two years. He applied for a long- 
term position and was selected as the successful 
candidate. During reference checks, the board 
spoke to an employee of another board, who was 
not one of the teacher’s referees. Through this 
conversation it was learned that the teacher’s 
employment had been terminated by the other 
board for unsatisfactory performance, and that 
there was an arbitration decision relating to the 
dismissal. 

The board obtained a copy of the arbitration 
decision, which was available from a public source. 
Based on the information contained in this deci- 
sion, the board terminated the teacher’s long term 
contract and also removed his name from the 
occasional teacher list, thereby terminating his 
employment entirely. The teacher complained that 
the collection and use of the information in the 
arbitration decision breached his privacy. 

The IPC determined that the school board had 
not provided proper notice for the collection of 
candidates’ personal information, since the notice 
did not contain all the elements required by the 
Act. The notice did state, however, that the per- 
sonal information collected would be used for the 
purpose of the long term competition only. 

Therefore, we found that in relying on the 
teacher’s personal information in the arbitration 
decision to terminate the long-term contract, the 
board had used the information for the purpose for 
which it had been collected. This use of the per- 
sonal information was thus in accordance with the 
Act. However, we found that the board’s use of the 
personal information to remove the teacher’s name 
from the occasional teacher list was neither for the 
purpose for which it had been collected, nor for a 
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consistent purpose. This use by the board, thus, 
was not in accordance with the Act. 

We recommended that the board: provide 
proper notice for collection of personal infor- 
mation for job competitions and reference checks; 
obtain written authorization from job candidates 
to contact referees; and restrict the collection of 
personal information to referees the board has been 
authorized to contact. (Investigation 193-009M) 


MONITORING EMPLOYEE ATTENDANCE 


An employee at a correctional facility operated by 
the Ministry of the Solicitor General and Correc- 
tional Services complained about attendance review 
letters sent to employees whose rate of absenteeism 
was becoming unacceptable. He said that the 
Ministry had not at any time notified the indivi- 
duals involved that the personal information 
contained in these letters had been collected. 

The Ministry acknowledged that direct notice 
of the collection of attendance information had not 
been given to staff hired before the Act took effect. 
However, the Ministry argued that the employees 
had been adequately notified, since information 
about the collection appeared in the 1993-1994 
Directory of Records. 

The IPC found that including the collection in 
the Directory of Records did not constitute suffi- 
cient notice. Otherwise employees would have to 
check the directory regularly to find out what 
information the employer was collecting — an 
approach that would be inconsistent with the 
purposes of the Act. (Investigation 193-047P) 


PROCESSING OF WCB CLAIM 


An employee of a municipal ambulance service 
who had experienced “critical incident” stress used 
the services of the employer’s staff psychologist and 
filed a claim with the Workers’ Compensation 
Board (WCB). The employee later alleged that his 
supervisor had improperly collected and disclosed 
his personal information to the WCB, and that the 
psychologist had improperly disclosed his personal 
information to both the supervisor and the WCB. 
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The ambulance service had a health and safety 
unit that was responsible, among other things, for 
the administration of WCB claims. The IPC found 
that the supervisor’s collection of information to 
submit to the unit was necessary for a lawfully 
authorized activity, namely processing of an em- 
ployee’s WCB claim. Hence it was in accordance 
with the Act. 

However, the supervisor’s disclosure of the 
employee’s personal information directly to the 
WCB was not found to be in accordance with the 
Act. While the Workers’ Compensation Act requires 
an employer to provide the WCB with information 
respecting a claim, it was the health and safety unit 
rather than the supervisor who was responsible 
for acting on the employer’s behalf in claims 
administration. 

In addition, the psychologist’s disclosure to the 
supervisor was not in accordance with the Act. The 
supervisor did not need the information to perform 
his duties regarding the WCB claim. Furthermore, 
the disclosure was not for the same purpose as the 
collection, that is, the well-being of the employee. 
It was the psychologist and the critical stress 
debriefing team of which he was a member — not 
the supervisor — that had primary responsibility for 
the employee’s well-being. 

The psychologist’s disclosure to the WCB, on 
the other hand, was in accordance with the Act. 
The WCB has authority to require employers to 
provide claims information and the psychologist 
had been contacted as an employee of the ambu- 
lance service for full particulars on the claim. 
(Investigation 192-84M) 


Recommendations Implemented 


Each year, the IPC follows up to ensure that 
government organizations have implemented the 
recommendations contained in our investigation 
reports. In 1993 we followed up on 68 recommen- 
dations made between July 1, 1991 and September 
30, 1992. Sixty-five or 96 per cent of our recom- 
mendations had been implemented. The three 
remaining items involved one organization and had 
not been adopted due to cost and other operational 


factors. However, adequate compensating controls 


had been put in place. 


Forms Review Yields Lessons 


In addition to investigating complaints, the IPC 
reviews the practices of selected government 
organizations for handling personal information. 

In 1993 we conducted a forms review to 
examine a cross-section of provincial government 
forms and verify compliance with the notice 
requirements of the Act. We took this step because 
forms are frequently used to collect personal 
information and provide notice of collection. 

Under section 39(2) of the Act the notice of 
collection must include three components: the 
legal authority for the collection; the main purpose 
or purposes for which the information is to be 
used; and the title, business address and phone 
number of a public official who can answer ques- 
tions. 

Eleven Ministries participated in the review and 
in all 351 forms were examined. Of this sampling, 
37 per cent contained proper notice as required by 
the Act; 21.7 per cent complied with two of the 
three notice requirements; 5.1 per cent complied 
with only one of the provisions; and 36.2 per cent 
contained no notice of collection at all. 

We made several recommendations to the 
participating Ministries, which are also relevant to 
most government organizations covered by the 
Acts: 


° Organizations should review all their forms used 
to collect personal information, to ensure that they 
contain proper notice. 


+ Policies and procedures regarding compliance 
with the Acts should be distributed to all staff 
involved in the forms management process, as well 
as documented in manuals. 


+ These policies should cover all forms used, both 
externally and internally. 


+ Policies are not enough — they must be put into 
practice whenever forms are introduced or 


changed. 


Indirect Collection 


Under the legislation, the Commissioner has the 
power to authorize the collection of personal 
information “otherwise than directly from the 
individual” in appropriate circumstances. This year 
the IPC processed six applications for indirect 
collection and approved four of the six. 


WORKPLACE HARASSMENT PROGRAM 


The Liquor Control Board of Ontario sought 
authorization to collect personal information for its 
Workplace Harassment Prevention Program. The 
IPC was unable to approve the application because 
the proposed structure for the program led to 
significant privacy concerns. 

The intended procedures combined the roles of 
advisor and investigator in the same personnel. We 
felt that employees would have greater privacy if 
they could seek advice from a person responsible 
only for providing information and explaining 
options. Also, for the sake of objectivity, it was 
essential that the investigator be as far removed 
from the parties as possible. Combining the roles 
of advisor and investigator would make it difficult 
to tell when a complaint moved from one stage to 
the next. 


Comments on Government Activity 


Occasionally, issues arise during an investigation 
that go beyond the scope of the complaint being 
examined and call for further comment by the 


IPG: 


EMPLOYEE MEDICAL INFORMATION 


A case this year involved a section of the Workers’ 
Compensation Act, which authorizes the Workers’ 
Compensation Board to disclose medical records to 
employers. Sensitive information about employees’ 
sexual lives with their spouses had been divulged to 
employers in support of disability claims. 
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While the IPC held that the disclosure was not 
contrary to the Freedom of Information and Protec- 
tion of Privacy Act, we nonetheless felt that the 
release of such sensitive information could pose a 
significant threat to the privacy of the individuals 
concerned. We suggested that Ontario consider the 
scheme that has been adopted in Quebec. Legisla- 
tion there requires the Board to release the worker’s 
medical records to a health professional designated 
by the employer, who then provides the employer 
with a summary of the record. 


TRAFFIC MONITORING 


The IPC also offers comment on specific situations 
having privacy implications that come to our 
attention. This year we responded to an incident 
concerning the Ministry of Transportation’s 
COMPASS traffic management video cameras, 
installed to monitor traffic flow and road 
conditions. 

The incident involved a Ministry employee 
who was monitoring traffic and noticed an assault 
occurring on a highway. The employee used the 
video camera to get a closer look and called the 
Ontario Provincial Police. The police made an 
arrest and requested a copy of the videotape for law 
enforcement purposes. 

In response to our inquiry, the Ministry stated 
that under its standard operating instructions, the 
video cameras should not be used to obtain close- 
up images, thereby identifying an individual. The 
incident in question was therefore contrary to the 
Ministry’s standard procedures. 

The Ministry indicated that it would begin 
education and awareness sessions to ensure that all 
staff involved in video monitoring of traffic under- 
stand the implications of the privacy Act. The 
Ministry was also planning to update its standard 
operating instructions to reflect this position. 

The IPC replied that our objective was to see 
that the uses of the COMPASS system do not result 
in invasions of personal privacy. We stressed, 
however, that the Ministry’s efforts to comply with 
the Act should not compromise the safety of 
Ontario motorists. 
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The Information and Privacy Commissioner 
conducts research on access and privacy questions 
and advises government organizations on infor- 
mation management and data protection. We raise 
access and privacy issues for public debate, and 
advocate government legislation and policies to 
ensure that general records are open to scrutiny 
while personal information is safeguarded. 


Workplace Privacy Safety-Net 


In a report released in November 1993, the IPC 
urged the Ontario government to legislate a 
workplace privacy safety-net covering both the 
public and private sectors. This report reflected 
feedback on a consultation paper distributed to key 
business, labour and advocacy groups in mid-1992. 

It is estimated that every day millions of North 
American workers are monitored electronically on 
the job. Employers watch employees on closed- 
circuit television, track employee telephone activ- 
ity, listen in on phone conversations, intercept 
electronic mail and program computers to collect 
data on users. We believe such monitoring prac- 
tices are fundamentally degrading, and inevitably 
undermine employee morale and the quality of 
working life. 

Various forms of employee testing also give 
serious cause for concern. For example, random 
drug tests show only that drugs or alcohol have 
been consumed at some point prior to the test; 
they do not in fact demonstrate the use of drugs or 
alcohol in the workplace or measure the impact on 
job performance. And genetic testing has ominous 
potential, as it may ultimately be used to screen 
individuals for specific inherited traits or disorders 
in an attempt to select a work force free of all 
genetic risks. 

The privacy safety-net proposed by the IPC 
includes: a ban on mandatory genetic, drug and 
HIV/AIDS testing in the workplace; strict controls 
on electronic surveillance of employees; and new 
safeguards for employment records in the private 
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sector, paralleling those now in force for govern- 
ment employees. 


Confidentiality of Health Care Data 


Health care information is probably the most 
sensitive type of personal information routinely 
compiled in our society. However, Ontario’s 
existing access and privacy Acts have a very limited 
effect on health care records, since they apply only 
to provincial and municipal government organiza- 
tions and exclude most hospitals. 

In the absence of comprehensive regulations, 
decisions as to whether patients can access their 
own health care records are essentially left up to 
individual physicians and other health care practi- 
tioners. That may have been acceptable in an 
earlier, paternalistic era — but the IPC feels it is far 
too arbitrary and subjective for the health care 
consumers of the 1990s. 

Furthermore, patients have no real control over 
their health care information after they provide it. 
There is little assurance that this sensitive infor- 
mation will be handled in a secure, systematic 
fashion, with due respect for confidentiality. 

The Ontario Ministry of Health has been 
developing health care information access and 
privacy legislation on and off for several years. The 
IPC has emphatically urged the Ministry to make 
this effort a top priority. While still reluctant to 
introduce new legislation, the Ministry has agreed 
to consider increasing privacy protection through 
changes to regulations under existing pieces of 
legislation. 

The problem of health card fraud has led 
Canadian governments to look into new types of 
personal identification for the health registration 
system. In Ontario the introduction of a photo 
health card has raised questions regarding the 
collection, use and disclosure of personal infor- 
mation. The IPC has underlined that privacy 
protection must be considered at the earliest 
possible stage in the development of any photo 
health card technology. 


The Ministry of Health is reforming Ontario’s 
drug programs. One initiative is the creation of a 
computer system linking Ministry databanks, 
pharmacies and ultimately doctors’ offices. The 
IPC this year continued to meet regularly with 
Ministry staff developing the system to deal with 
issues of access, consent, notification, correction 
and security. 


Information as a Commodity 


In the ’90s information has become a commodity — 
a tradeable product that can be bought and sold. 
The Ontario government is seeking opportunities 
to sell rights to government-held data as a new 
source of revenue. The IPC has raised concerns 
with the government’s plans, from both access and 
privacy perspectives. 

Access questions are involved when government 
information — to which the public has a right of 
access under the Act — is distributed through 
private vendors. It is essential to make it clear that 
the public will continue to enjoy unimpeded access 
through the usual freedom-of-information process. 
Otherwise, access could come to depend on the 
ability to pay, leading to the emergence of an 
information elite. 

Privacy concerns are based on the potential for 
disclosure of personal information. Since the 
privacy safeguards of the Act do not apply to public 
databases, personal information in public databases 
can be sold to private vendors. It is possible for a 
government organization to designate a database as 
being public through a simple policy decision, 
without legislation. 

In the current fiscal climate, government might 
feel increased pressure to declare more databases 
public, in order to create more opportunities for 
revenue. Such a trend would lessen privacy protec- 
tion in Ontario. 

The IPC has urged the provincial government 
to evolve a clear policy safeguarding the principles 
of the Act when government-held information is 
distributed by the private sector. We have recom- 
mended that the government consult widely with 
the public in developing such a policy. 
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New Technology Threatens Privacy 


SMART CARDS 


A smart card is a wallet-size plastic card that 
contains a computer chip with the capacity to hold 
vast quantities of data. Smart cards are being 
developed by various government organizations as 
access cards to programs and services. The IPC is 
worried that the piecemeal adoption of smart card 
technology could lead to a steady erosion of per- 
sonal privacy. 

In a paper released this year, we called on 
provincial and municipal governments to under- 
take a co-ordinated strategy for the adoption of 
advanced card technology. Privacy protection 
standards should be adopted for all smart card 
applications — addressing such issues as the card’s 
purpose, its contents, access to the information 
stored, and the rights of cardholders. The strategy 
should also require a privacy impact statement to 
resolve privacy issues before a new or revised smart 
card application is approved. 


TELECOM REVOLUTION CONTINUES 


The combination of computer technology with the 
telephone system is revolutionizing communica- 
tions but also threatening to erode the level of 
privacy we have come to expect. This year the IPC 
continued its advocacy in this area with two 
submissions to the Canadian Radio-Television and 
Telecommunications Commission (CRTC). 

In one, we supported prohibition of automatic 
dialling and announcing devices to place calls for 
commercial purposes. These devices have been 
used for telemarketing at all hours of the day and 
night and may tie up the line after the call has 
ended. 

In the other submission, we commented on the 
introduction of a name display feature as part of 
call management services. At present the phone 
number of incoming calls can be displayed on a 
screen through a feature known as “Caller ID”. 
The proposal to also display the caller’s name raises 
new privacy issues. 
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We recommended that businesses be prohibited 
from using the name-display feature to compile 
marketing lists, and that customers be offered 
options for the display of names and numbers, 
with free blocking of this feature available on both 
a per call and per line basis. We also stressed that 
telephone users have the right to know how call 
management services will impact on their privacy. 


PHOTO RADAR 


The Ontario government plans to introduce photo 
radar on a trial basis, for the purpose of enforcing 
highway speed limits. This new system utilizes 
roadside cameras that take pictures of speeding 
vehicles. The IPC questioned whether the pur- 
ported traffic safety benefits truly outweigh the 
threat to privacy posed by this technology. 

Our central concern is that vehicles, drivers, 
passengers and even pedestrians who happen to be 
in the vicinity of the speeding vehicle could be 
captured on the photo. We will continue to work 
with staff of the government’s Integrated Safety 
Project to enhance privacy in the application of 
photo radar. 


COMPUTER MATCHING GUIDELINES 


Another privacy issue in the electronic age is 
computer matching by government organizations. 
Computer matching involves comparing infor- 
mation on specific individuals in databases col- 
lected for different purposes, or searching through 
databases to identify individuals who meet certain 
criteria. 


A purpose of computer matching is to improve 
the efficiency of government programs and serv- 
ices. This objective must be weighed against the 
dangers to privacy. To provide direction on balanc- 
ing these priorities, Management Board Secretariat 
(MBS) this year released a draft Directive and 
Guidelines on Computer Matching of Personal 
Information. 

This MBS initiative stems from the review of 
the provincial Act by a standing committee of the 
Legislature in 1991. At the urging of the IPC, the 
standing committee proposed an examination of 
computer matching and the resulting privacy 
concerns. 

The IPC provided comments to MBS on the 
draft documents with a view to reinforcing privacy 
protection and public accountability. For example, 
we suggested expanding the requirements for 
notifying the public about computer matching 
initiatives. 


Financial Services Sector Evolving 


The financial services industry is changing rapidly, 
and the boundaries between banks, credit unions 
and insurance companies are expected eventually to 
disappear. This will allow the various types of 
institutions to offer a wider range of financial 
services than in the past. The risk, as the IPC sees 
it, is that information a customer supplied to one 
type of institution for a particular service may be 
transferred to another part of the organization or to 
an allied company. 

The Ontario government has a review of 
financial services in the province under way. The 
IPC made a submission to the ministry responsible 
to offer suggestions for protecting privacy. 


COMMUNICATIONS AND PUBLIC EDUCATION STRENGTHENED 


The IPC works to inform Ontarians of their rights 
and responsibilities under the Acts, and to heighten 
the public profile of access and privacy issues. We 
assist clients — people who use the information and 
privacy system — to understand their options as 
well as our practices and procedures. And we help 
government organizations, both provincial and 
municipal, to comprehend their obligations and 


how to fulfill them. 


Province-wide Outreach 


In 1993 we continued to strengthen our province- 
wide outreach effort. 

Through the IPC Speakers’ Bureau the 
Commissioner, Assistant Commissioners and staff 
completed 55 speaking engagements across On- 
tario. We addressed such groups as the Halton 
School Board in Burlington, a Canadian Bar 
Association meeting in Toronto, the Kent County 
Purchasing Agents in Chatham, the Thunder Bay 
Municipal Council, and academic groups at 
Queen’s University, McMaster University and the 
University of Western Ontario. 


Professional Development 
for Co-ordinators 


Freedom of information and privacy co-ordinators 
in government organizations play a key role in the 


day-to-day operation of the access and privacy 
system. This year the IPC participated in 16 
training sessions for municipal and provincial co- 
ordinators in all regions, in co-operation with 
Management Board Secretariat. 

In addition, with Management Board Secre- 
tariat and the Association of Municipal Clerks and 
Treasurers of Ontario, we organized the co- 
ordinators’ fall workshop. This year’s event, “Ac- 
cess and Privacy: New Attitudes and Expectations”, 
enabled more than 200 participants to share 
experiences and keep up with current issues. 


Print Materials Distributed Widely 


We continued to run an active print communica- 
tions program to keep the Ontario, national and 
international access and privacy community 
informed of our activities. Our Perspectives newslet- 
ter reaches more than 4600 government organiza- 
tions, business groups and interested individuals. A 
quarterly publication, Précis, reports order and 
investigation highlights. 

And a third publication, Practices, provides 
government organizations, appellants and other 
interested readers with useful explanations and 
guidance on specific practices and procedures. The 
seven issues released this year covered topics rang- 
ing from “Providing Notice of Collection” to 
“Raising Discretionary Exemptions during an 


Appeal”. 
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FINANCIAL STATEMENT | 


Statement of Expenditure for 1993-94 1992-93 
the year ended March 31, 1994 $ $ 
Salaries and wages 5,455,199 5,107,014 
Employee benefits 906,057 793,339 
Transportation and communication 116,919 125,214 
Services 1,121,528 1,244,445 
Supplies and equipment 477,252 365,894 
8,076,955 7,635,906 


The figures for the period ending March 31, 1994 are unaudited. For a copy of the Provincial 
Auditor's report please contact the IPC Communications department at 416-326-3333 or 
1-800-387-0073; TTY (teletypewriter) 416-325-7539. 


Approved: 


A Ten WA 


Information and Privacy Commissioner 


